Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 21, 2021
European Parliament urges Commission to launch infringement proceedings against Ireland over GDPR enforcement
The European Parliament adopted a resolution calling on the European Commission to start infringement procedures against Ireland due to delays by the Irish Data Protection Commission in handling GDPR complaints. The resolution noted that…
European Commission · General Data Protection Regulation
Low
Enforcement
Announced
Austria · May 5, 2021
Austrian DPA may fine Google up to €6 billion for illegal EU‑US data transfers
The Austrian Data Protection Authority (DSB) has the option under the GDPR to impose a fine of up to €6 billion (4% of global turnover) on Google for continuing to transfer personal data from EU websites to the United States despite CJEU…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
France · Apr 6, 2021
noyb files complaint to French CNIL over Google’s Android Advertising ID tracking without consent
noyb lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Android Advertising Identifier (AAID) is installed on Android phones without user consent. The complaint cites the e‑Privacy Directive’s…
CNIL · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Mar 18, 2021
Irish DPC cancels scheduled EU‑US data‑transfer hearing with European Parliament
Irish Data Protection Commission head Helen Dixon cancelled her participation in a European Parliament LIBE Committee hearing scheduled for 18 March 2021 after demanding to be heard alone. The hearing was intended to discuss EU‑US data…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Feb 8, 2021
noyb files GDPR complaint against Austrian credit data broker KSV 1870
On 08.02.2021, the privacy NGO noyb lodged a GDPR complaint with the Austrian data protection authority alleging that KSV 1870 stores identification data from access requests in its commercial database, violating purpose‑limitation. The…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
Germany · Jan 28, 2021 · deadline Feb 12, 2021
Hamburg DPA preliminarily deems Clearview AI’s biometric profiling of EU residents illegal and orders partial deletion
The Hamburg Data Protection Authority preliminarily found that Clearview AI’s collection of biometric profiles of Europeans violates the GDPR and ordered the deletion of the mathematical hash values of the complainant’s biometric profile.…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Jan 26, 2021
Norwegian DPA fines Grindr €9.63 million for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 100 Mio NOK on Grindr for sharing personal and sensitive data without valid consent. The authority found Grindr's consent mechanism invalid and highlighted the company's lack of…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Settlement
Settled
Ireland · Jan 13, 2021
Irish DPC settles judicial review, pledges swift decision on Facebook EU‑US data transfers
The Irish Data Protection Commission (DPC) settled a judicial review with Max Schrems and agreed to decide quickly on Facebook's EU‑US data flows. The settlement allows Schrems to be heard in the DPC's own‑volition procedure and to access…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Nov 16, 2020
noyb files complaints against Apple's IDFA tracking code
The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 21, 2020
noyb files GDPR complaint against Wizz Air over charged rectification request
On 21.10.2020 noyb filed a GDPR complaint with the Austrian Data Protection Authority against Wizz Air for charging €35 to update a passenger's surname. The airline required the passenger to call a paid hotline to make the change…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Oct 13, 2020
noyb files GDPR complaint against Austrian address broker AZ Direct for lack of source and recipient transparency
noyb lodged a GDPR complaint with the Austrian data protection authority against AZ Direct Österreich GmbH for refusing to disclose the origin and recipients of address data. The company claimed it was too burdensome to keep precise…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Sep 25, 2020
noyb reports companies' limited responses to GDPR data‑transfer inquiries after Schrems II
The non‑profit noyb contacted 33 firms in mid‑2020 asking for details on their international data transfers under Articles 12‑15 of the GDPR, following the CJEU Schrems II ruling. Many companies either did not reply or gave only generic…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Sep 22, 2020
noyb files 101 complaints against EU website operators for illegal US data transfers
noyb lodged 101 complaints against EU/EEA website operators using Google Analytics and Facebook Connect, alleging illegal transfers of personal data to the US. The complaints rely on the CJEU judgment of 16 July 2020 that such transfers…
EDPB · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Sep 16, 2020
Austrian DSB decides on Flimmit streaming complaint after 1.5 years
In September 2020 the Austrian Data Protection Authority (DSB) issued a decision on the complaint against Vienna streaming service Flimmit filed by noyb. The DSB rejected the complaint because Flimmit provided the missing information about…
Datenschutzbehörde (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 17, 2020
101 GDPR complaints filed against EU companies for US data transfers to Google and Facebook
Noyb has filed 101 complaints in all 30 EU and EEA member states alleging that European companies continue to forward visitor data to Google and Facebook in the US. The complaints cite the CJEU ruling that the EU‑US Privacy Shield is…
Data Protection Authorities · Standard Contractual Clauses
